4
votes
2answers
169 views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
0
votes
1answer
150 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
3
votes
2answers
737 views

Encrypt web.config file using Data Protection API

I have encrypted part of my web.config file using the Data Protection API. Now, my question is, what does a hacker need in order to decrypt the web.config file? Does he require physical access to ...
3
votes
1answer
101 views

Windows Phone and Hardcoding Values

Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
6
votes
3answers
535 views

NTLMv2 resistance to bruteforcing

I have a question regarding NTLMv2 resistance to password bruteforcing. I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
4
votes
3answers
12k views

Windows 7 Password Hash Security

I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes. I understand that these hashes are stored in the SAM ...
0
votes
1answer
687 views

Should I use Windows' Cryptographic Service Provider to generate RSA keys?

If I want to generate strong high quality RSA keys, is there any reason not to use Microsoft's built-in cryptography system? Or should I use something open source like OpenSSL or Bouncy Castle? I'm ...
5
votes
2answers
271 views

Do any crypto libraries take advantage of Windows GPU API “Direct Compute”?

Are there any encryption (decryption?) libraries that take advantage of the Windows GPU API?
3
votes
1answer
2k views

Are Windows password hashes salted with the user name?

I'll readily admit I'm pretty clueless when it comes to cryptography, so there may already be some false assumptions in the question title itself :-) Still, I "heard" that it is more secure to store ...
12
votes
5answers
4k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
9
votes
3answers
1k views

How can I mitigate the threat that DPAPick poses to my DPAPI protected data?

The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications). DPAPick was presented at BlackHat ...
8
votes
3answers
5k views

How can I enumerate all the saved RSA keys in the Microsoft CSP?

I have an application that is creating several keys and storing them in various stores (in this case the Machine store). How can I enumerate all the keys on a given Windows system? ...